More than $7,216: that is how much the extortion operator had spent on AI services by October 22 while simultaneously leaving its entire workspace exposed on a public server, security researchers found.
AI-assisted tooling: OpenCode, 154 model entries, and hundreds of scripts
SOCRadar’s investigators found the operator using OpenCode, an open-source AI coding agent, configured with 154 model entries across seven providers. The list of models documented in the locker included Gemini, Mistral, Nemotron, Llama, Claude, GPT-5.x, Grok, Kimi, GLM, DeepSeek, MiniMax, and Qwen, among many others. SOCRadar reported that some models had safety training removed and others were marketed as “uncensored.”
According to Ensar Seker, chief information security officer of SOCRadar, “The operator used AI to write and debug hundreds of scripts. That shows how AI can help an attacker turn basic access into a broader, tailored operation.” The AI environment was stored alongside attack scripts and extortion infrastructure in the exposed workspace.
Access methods: RDP scanning, FortiGate credential stuffing, and exposed cloud keys
Contrary to breathless predictions of an AI-driven “breachpocalypse,” SOCRadar found no evidence that n0n exploited software vulnerabilities to gain entry. “In every documented compromise in this investigation, access relied on weak or stolen credentials,” Seker told The Register.
Instead, the group relied on widespread Remote Desktop Protocol (RDP) scanning and automated FortiGate SSL‑VPN credential stuffing. To probe US-based managed services provider ChiBiTek, the operators used a 15‑thread residential SOCKS5 proxy pool to test ip:port:user:password credential combos against FortiGate portals (GET /remote/login). The crew also used exposed cloud credentials and reused hosting portal sessions to move inside environments.
In a case linked to e-commerce site Fanatics, SOCRadar documented use of an exposed AWS access key with permissions to list, read, and delete objects. The actors used that key to pull data from 40 S3 buckets — up to 110 GB per bucket — and then deleted data, including bank‑transaction archives, and purged keys across 12 sensitive buckets.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildThe exposed workspace: a Swedish server with 1,719 files
SOCRadar located the operator’s publicly accessible Python HTTP file server in Sweden at 185.157.161[.]148 on port 8877 and captured directory snapshots on September 25 and 26. Across those snapshots the team identified 1,719 files, including attack scripts, ransomware source code, extortion infrastructure, and the AI coding agent environment.
The locker contained evidence of operational shortcuts: hardcoded encryption keys with signs they were reused across victims, scripts to collect credentials and session tokens, hidden admin accounts disguised as services, and tools to intercept mailboxes and emailed multi-factor authentication codes. SOCRadar observed both theft and destructive behavior — files encrypted and stolen, backups deleted in some cases, and at least one instance where firewall policies were changed to block traffic.
n0n’s campaign: 108 claimed victims, maritime batch, and public pressure tactics
Since emerging last month, the group calling itself n0n claimed 108 victims. On October 12 the gang added 38 maritime, port, and logistics organizations across 18 countries to its leak site in a single batch; SOCRadar linked at least 21 of those to customers of South Korean maritime software provider CyberLogitec, though the software provider had not confirmed any intrusion.
For the maritime batch n0n set an October 19 deadline and demanded ransoms ranging from $400,000 to $28 million payable in Bitcoin. After the deadline none of the 38 listings were marked “settled,” and SOCRadar found no validated on‑chain transactions for that set; all affected organizations’ stolen data was published. While a handful of listings on the leak site were labeled “honored - data destroyed,” SOCRadar said it had not validated any payments on‑chain.
n0n’s playbook included posting countdown clocks and automated countdown warnings to victims’ service providers, clients, and media outlets, establishing negotiation rooms and emails, and leaking stolen files or destroying backups when demands weren’t met. In one episode after breaking into Netherlands‑based Transcom, the operators even sent a secondary ransom alert directly to PayPal’s security team, despite the compromised data residing only on Transcom’s network.
What this means for technologists, affected enterprises, and procurement leaders
- Technologists and security teams: prioritize credential hygiene, monitoring for credential stuffing and RDP brute force activity, and alerting on unusual use of cloud access keys and session reuse. The incident shows attackers convert basic access into broader operations when credential controls and session protections fail.
- Affected enterprises and maritime software providers (e.g., CyberLogitec customers): audit cloud permissions (S3 keys and list/delete rights), verify off‑site, immutable backups, and watch for automated external disclosures and negotiation tactics designed to amplify reputational harm.
- Procurement leaders: scrutinize access models for third‑party providers and insist on least‑privilege cloud keys, tight session expiry, and multi‑factor protections for management portals after the group demonstrated ease of lateral movement via reused sessions and exposed credentials.
SOCRadar summed the episode bluntly: “There is a striking gap between operational ambition and security discipline.” The case of n0n is a reminder that sophisticated-sounding toolkits and AI-assisted scripting can amplify damage — but they do not replace the fundamentals. The more urgent question now is whether defenders will close the simple doors these attackers repeatedly walk through, or whether the next operator will learn from n0n’s methods without repeating its basic mistakes.
